filenamex.dll
size458240 (0x6fe00)
md51dcc7ea39a157822bcb8c683bbbec0dd
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
138210221
1235072715
1077
132210228
146210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x5937e54d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x6800
SizeOfInitializedData0x138200
SizeOfUninitializedData0
AddressOfEntryPoint0x1090
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x142000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x540
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++

Sections

namevavsizeraw sizeflags
.text0x10000x664e0x6800R-X CODE
.rdata0x80000x605f20x60600R-- IDATA
.data0x690000xd46c00x5800RW- IDATA
.reloc0x13e0000x337a0x3400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x682600x392
IMPORT0x67b400x78
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x13e0000x261c
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x80000x130
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
PSAPI.DLL20GetProcessImageFileNameW
VERSION.dll4GetFileVersionInfoSizeW
VERSION.dll5GetFileVersionInfoW
VERSION.dll13VerQueryValueW
KERNEL32.dll1111VirtualFree
KERNEL32.dll673HeapFree
KERNEL32.dll547GetProcessHeap
KERNEL32.dll1194lstrcmpW
KERNEL32.dll669HeapAlloc
KERNEL32.dll1206lstrlenW
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll1197lstrcmpiW
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll979SetEvent
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll1089UnmapViewOfFile
KERNEL32.dll67CloseHandle
KERNEL32.dll778MapViewOfFile
KERNEL32.dll812OpenFileMappingW
KERNEL32.dll808OpenEventW
KERNEL32.dll124CreateFileMappingW
KERNEL32.dll117CreateEventW
KERNEL32.dll1035SetThreadPriority
KERNEL32.dll1014SetPriorityClass
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll163CreateThread
KERNEL32.dll202DeviceIoControl
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll127CreateFileW
KERNEL32.dll1070TerminateThread
KERNEL32.dll281FindClose
KERNEL32.dll292FindFirstFileW
KERNEL32.dll872ReadFile
KERNEL32.dll468GetFileSize
KERNEL32.dll846QueryDosDeviceW
KERNEL32.dll492GetLogicalDriveStringsW
KERNEL32.dll641GetWindowsDirectoryW
KERNEL32.dll195DeleteFileW
KERNEL32.dll498GetLongPathNameW
KERNEL32.dll81CompareFileTime
KERNEL32.dll544GetProcAddress
KERNEL32.dll756LoadLibraryW
KERNEL32.dll693InitializeCriticalSectionAndSpinCount
KERNEL32.dll630GetVersionExW
KERNEL32.dll1057Sleep
KERNEL32.dll857QueueUserWorkItem
KERNEL32.dll479GetFullPathNameW
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll819OpenProcess
KERNEL32.dll875ReadProcessMemory
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll823OpenThread
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll1122WaitForMultipleObjects
KERNEL32.dll1205lstrlenA
KERNEL32.dll784Module32NextW
KERNEL32.dll782Module32FirstW
KERNEL32.dll172CreateToolhelp32Snapshot
KERNEL32.dll1073Thread32Next
KERNEL32.dll1072Thread32First
KERNEL32.dll838Process32NextW
KERNEL32.dll836Process32FirstW
KERNEL32.dll906ResetEvent
USER32.dll776wsprintfW
ADVAPI32.dll104ConvertSidToStringSidW
ADVAPI32.dll497OpenProcessToken
ADVAPI32.dll340GetTokenInformation
ADVAPI32.dll395LookupAccountSidW
ADVAPI32.dll369InitializeSecurityDescriptor
ADVAPI32.dll688SetSecurityDescriptorDacl
ordentry_vafunction_name
10x74b0GetDeviceName
20x7480GetFileTypeName
30x7490GetOperationName
40x7470GetStatusData
50x74a0GetTypeOpenName
60x7430InitFilesLoger
70x7420InitLoger
80x7560InitProcessLoger
90x75d0InitUserDebugThread
100x75e0ManualPrThrRegInfo
110x7460ReleseFilesLoger
120x7600ReleseLoger
130x75f0ReleseProcessLoger
140x7540ResetAllFiltrs
150x7530ResetPathsExclude
160x7510ResetPathsInclude
170x74f0ResetProcessIdsExclude
180x74d0ResetProcessIdsInclude
190x7550SetMaxSizeFileModifed
200x7520SetPathsExclude
210x7500SetPathsInclude
220x74e0SetProcessIdsExclude
230x74c0SetProcessIdsInclude
240x75b0StartDebugLoger
250x7440StartFilesLoger
260x7570StartProcessThreadLoger
270x7590StartRegistryLoger
280x75c0StopDebugLoger
290x7450StopFilesLoger
300x7580StopProcessThreadLoger
310x75a0StopRegistryLoger
module_nameKernelLogerSDK.dll
flags0
timestamp2017-06-07 11:36:45
version0.0
ordinal_base1
nFunctions31
nNames31
Names(31)0x68304
Functions(31)0x68288
NameOrdinals(31)0x68380
offsetsizetypecomment
0458240DLL06/07/2017 11:36:45#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK